Brute force detection

[rahul_mckc_splu]

This is my search for detecting brute force behavior-
index="wineventlog" sourcetype=wineventlog:security | stats dc(action) as Attempts, earliest(_time) as FirstAppearance
count(eval(match(action,"failure"))) as Failed,
count(eval(match(action,"success"))) as Success
max(eval(case(match(action,"failure"),_time))) as lastFailed
max(eval(case(match(action,"success"),_time))) as lastSuccess
values(src) as src by user
| where Attempts>1 AND Failed>100 AND Success>0
| where lastFailed < lastSuccess

Now what is happening it is taking cumulative of 100 as failures and if there is 1 success then it is triggering....
My question is how can i restrict it to 100 failures consecutive prior to 1-success i mean 1st event should not be success.

[adonio]

nice answer by @woodcock here:
https://answers.splunk.com/answers/368521/how-can-i-detect-a-successful-login-after-multiple.html
another one by @lguinn here:
https://answers.splunk.com/answers/553596/detect-successful-bruteforce-attacksuccessful-logi.html

there are more out there